From 4ea127ed03feeae1ace8f38b60466bf842528fb1 Mon Sep 17 00:00:00 2001
From: Bernhard Posselt <dev@bernhard-posselt.com>
Date: Tue, 6 Jan 2015 17:06:22 +0100
Subject: set noreferrer tag for links pointing to articles

---
 db/item.php                                             | 2 +-
 templates/part.content.php                              | 6 +++++-
 tests/unit/articleenhancer/XPathArticleEnhancerTest.php | 6 +++---
 tests/unit/db/ItemTest.php                              | 2 +-
 4 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/db/item.php b/db/item.php
index af76002ff..24cc45de1 100644
--- a/db/item.php
+++ b/db/item.php
@@ -208,7 +208,7 @@ class Item extends Entity implements IAPI, \JsonSerializable {
     public function setBody($body) {
         // FIXME: this should not happen if the target="_blank" is already
         // on the link
-        parent::setBody(str_replace('<a', '<a target="_blank"', $body));
+        parent::setBody(str_replace('<a', '<a target="_blank" rel="noreferrer"', $body));
     }
 
 }
diff --git a/templates/part.content.php b/templates/part.content.php
index b917240aa..90925f5fa 100644
--- a/templates/part.content.php
+++ b/templates/part.content.php
@@ -33,6 +33,7 @@
                         <a class="external icon-link"
                             ng-click="Content.markRead(item.id)"
                             target="_blank"
+                            rel="noreferrer"
                             ng-href="{{ ::item.url }}"
                             title="<?php p($l->t('Open website')) ?>"
                             news-stop-propagation>
@@ -105,6 +106,7 @@
                     <h1>
                         <a class="external"
                             target="_blank"
+                            rel="noreferrer"
                             ng-href="{{ ::item.url }}"
                             title="{{ ::item.title }}">
                             {{ ::item.title }}
@@ -135,7 +137,9 @@
                         </p>
                         <a class="button"
                            ng-href="{{ ::item.enclosureLink | trustUrl }}"
-                           target="_blank">
+                           target="_blank"
+                           rel="noreferrer"
+                           >
                             <?php p($l->t('Download')) ?>
                         </a>
                     </news-enclosure>
diff --git a/tests/unit/articleenhancer/XPathArticleEnhancerTest.php b/tests/unit/articleenhancer/XPathArticleEnhancerTest.php
index 2d207d177..77c5ef2e7 100644
--- a/tests/unit/articleenhancer/XPathArticleEnhancerTest.php
+++ b/tests/unit/articleenhancer/XPathArticleEnhancerTest.php
@@ -181,10 +181,10 @@ class XPathArticleEnhancerTest extends \PHPUnit_Framework_TestCase {
 
         $result = $this->testEnhancer->enhance($item);
         $this->assertEquals('<div>' .
-            '<a target="_blank" ' .
+            '<a target="_blank" rel="noreferrer" ' .
                 'href="https://www.explosm.net/a/relative/url.html?a=1#b">' .
                 'link</a>' .
-            '<a target="_blank" ' .
+            '<a target="_blank" rel="noreferrer" ' .
                 'href="https://www.explosm.net/all/b/relative/url.html">' .
                 'link2</a>' .
             '<img src="https://www.explosm.net/another/relative/link.jpg">' .
@@ -230,7 +230,7 @@ class XPathArticleEnhancerTest extends \PHPUnit_Framework_TestCase {
         $this->assertEquals(
             '<div>' .
             '<img src="http://www.url.com/absolute/url.png">' .
-            '<a target="_blank" href="mailto:test@testsite.com">mail</a>' .
+            '<a target="_blank" rel="noreferrer" href="mailto:test@testsite.com">mail</a>' .
             '</div>',
             $result->getBody()
         );
diff --git a/tests/unit/db/ItemTest.php b/tests/unit/db/ItemTest.php
index 4ced884c8..c937053d1 100644
--- a/tests/unit/db/ItemTest.php
+++ b/tests/unit/db/ItemTest.php
@@ -264,7 +264,7 @@ class ItemTest extends \PHPUnit_Framework_TestCase {
     public function testMakeLinksInBodyOpenNewTab() {
         $item = new Item();
         $item->setBody("<a href=\"test\">ha</a>");
-        $this->assertEquals("<a target=\"_blank\" href=\"test\">ha</a>",
+        $this->assertEquals("<a target=\"_blank\" rel=\"noreferrer\" href=\"test\">ha</a>",
             $item->getBody());
     }
 
-- 
cgit v1.2.3